CVE-2026-114612: LiteLLM Proxy Encrypted a Forged Admin Credential With the Key It Trusts for Sessions, Giving Any Internal User Admin and Command Execution Through MCP stdio (CVSS 9.9)

NVD published CVE-2026-114612 on 22 October 2026 (CVSS 9.9, GitHub advisory GHSA-7hp6-4w63-5g45). From 1.87.0, the LiteLLM proxy used one cryptographic context both to encrypt secrets at rest and to issue session tokens. An authenticated internal user could put crafted metadata containing a forged proxy-administrator credential through the API-key flow, get it back encrypted, and replay that ciphertext as a bearer token; the proxy then trusted the forged admin identity, which gave administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 to 1.90.x are exposed only with EXPERIMENTAL_UI_LOGIN enabled; from 1.91.0 the default configuration is exploitable. It is fixed in 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0-rc.2. This is separate from the 1.107.0 supply-chain compromise published the day before.

You are affected if you run litellm >=1.87.0 <1.100.4 || >=1.101.0 <1.101.3 || >=1.102.0 <1.102.2 || >=1.103.0 <1.103.1 || >=1.104.0-rc.0 <1.104.0-rc.2. Versions 1.100.4 and later include the fix.

Upgrade the proxy to 1.100.4, 1.101.3, 1.102.2, 1.103.1 or a later release, but not 1.107.0, the compromised build: pin 1.106.2 or a verified later version. Rotate the proxy master key and any keys or session tokens issued while vulnerable, and review the admin audit log for keys created with unexpected metadata, admin actions by non-admin users, and MCP stdio servers added or invoked through the proxy. Because an admin on this proxy can run commands on its host, restrict the UI and API to the networks that need them and treat the proxy host as holding every provider key it stores.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run litellm and which version, then enforce a policy on it.